May contain `\r` too? We handle Base64 transfer-encoding elsewhere, too. Why are we duplicating it here?